Stack-based buffer overflow in VERITAS Backup Exec Remote Agent 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for Netware allo…

published 2005-06-18 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-0774

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 86.4%; EPSS 86.4% chance of exploitation in 30 days, percentile 99.7%
public exploits: 2; Metasploit, Exploit-DB

Stack-based buffer overflow in VERITAS Backup Exec Remote Agent 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for Netware allows remote attackers to execute arbitrary code via a CONNECT_CLIENT_AUTH request with authentication method type 3 (Windows credentials) and a long password argument.

Patch / fix

links 7

securitytracker.com/id?1014273 patch
securityfocus.com/bid/14022 patch
seer.support.veritas.com/docs/277429.htm patch
kb.cert.org/vuls/id/492105 advisory
seer.support.veritas.com/docs/276604.htm advisory
us-cert.gov/cas/techalerts/TA05-180A.html advisory
secunia.com/advisories/15789 advisory

Timeline

2005-06-18 Published
2005-06-22 First public exploit (Metasploit exploit/windows/backupexec/remote_agent)

Exploit prediction

86.37% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/backupexec/remote_agent Veritas Backup Exec Windows Remote Agent Overflow metasploit exploit, great rank, 2005-06-22
EDB-16332 Veritas Backup Exec Windows - Remote Agent Overflow (Metasploit) remote, 2010-07-03
securityfocus.com http://www.securityfocus.com/bid/14022 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

References

kb.cert.org /vuls/id/492105
third-party-advisory, patch, us-government-resource
securitytracker.com /id?1014273
vdb-entry, patch
securityfocus.com /bid/14022
vdb-entry, exploit, patch
seer.support.veritas.com /docs/277429.htm
patch
seer.support.veritas.com /docs/276604.htm
patch, vendor-advisory
us-cert.gov /cas/techalerts/TA05-180A.html
third-party-advisory, patch, us-government-resource
secunia.com /advisories/15789
third-party-advisory, patch, vendor-advisory
idefense.com /application/poi/display?id=272&type=vulnerabilities&flashstatus=true
third-party-advisory, vendor-advisory
osvdb.org /17624
vdb-entry

Sources

CVE List CVE-2005-0773
NVD CVE-2005-0773

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary